CVE-2026-59850

What it actually does

This is a use-after-free flaw in libssh channel handling. When SSH data packets are processed after a channel has already been closed, libssh can invoke channel data callbacks that reference channel-associated memory that has already been freed. The most likely result is a crash of the libssh-using process, causing a denial of service. The published CVSS vector indicates network reachability, low attack complexity, low privileges required, no user interaction, and availability impact only; no direct confidentiality or integrity impact is currently indicated.

Why it matters to the business

Applications, appliances, or services that embed the affected Red Hat libssh package may be remotely crashable by an authenticated or otherwise low-privileged SSH user, which can interrupt administration, automation, file transfer, or embedded SSH functionality. The vulnerability is not currently listed in CISA KEV, has low EPSS, and has no known public exploit maturity in the provided data, so the near-term exploitation likelihood appears low; however, internet-facing or multi-user SSH services using libssh should still be patched because the bug is network-reachable and can affect service availability.

How an attack unfolds

An attacker first obtains the ability to interact with an SSH service implemented with the vulnerable libssh library, typically by authenticating with a low-privileged account or reaching functionality that opens SSH channels. The attacker then manipulates SSH channel state by closing a channel and continuing to send or trigger data packets associated with that channel. Due to the flaw, libssh may process those packets after channel teardown and call data callbacks tied to memory that has already been released. This can cause the hosting process to dereference freed memory and crash. At present, the provided intelligence does not indicate known exploitation by named threat actors, ransomware campaigns, or public exploit availability.

How to fix it

Upgrade affected Red Hat libssh packages to the fixed release provided by the vendor. For the listed affected product, apply RHSA-2026:42922 and update libssh-main to 0.12.1-4.hum1 or later. Restart any services or applications dynamically linked against libssh after patching so the fixed library is loaded. Where immediate patching is not possible, reduce exposure by limiting SSH access to trusted networks, enforcing least-privilege SSH accounts, disabling unnecessary libssh-backed services, applying rate limits where supported, and monitoring for repeated connection failures or crashes. Rebuild and redeploy any statically linked applications that embedded a vulnerable libssh version.

How to confirm the fix worked

Confirm package remediation by checking that the installed libssh package version is 0.12.1-4.hum1 or later where RHSA-2026:42922 applies. Verify that running processes have been restarted and are no longer mapped to the old libssh shared object. On Linux systems, validate with package manager queries such as rpm -q libssh or equivalent vendor tooling, and inspect loaded libraries with lsof or /proc/<pid>/maps for long-running services. Confirm externally that exposed SSH services remain available after controlled channel open/close testing and that no crashes are generated. Vulnerability scanners should be updated to recognize RHSA-2026:42922 and the fixed package version.

Typical attack path

1. Identify a service, appliance, or application that uses the vulnerable Red Hat libssh package.
2. Establish an SSH session or otherwise reach libssh-backed SSH channel handling functionality.
3. Open one or more SSH channels through the service.
4. Close a channel while continuing to send or trigger data associated with that channel state.
5. Cause libssh to invoke callbacks for freed channel-associated data.
6. Crash the libssh-using process, resulting in denial of service or instability.

How to detect it

To determine whether this was already exploited, focus on evidence of denial-of-service behavior rather than data theft. Review authentication logs, SSH service logs, application logs for products embedding libssh, system journals, crash reporters, and core dump directories. Look for repeated SSH sessions from the same source followed by abrupt channel closures, service segmentation faults, abnormal exits, watchdog restarts, or core dumps in processes linked to libssh. On Linux, correlate /var/log/secure, /var/log/auth.log, systemd-journald, auditd, kernel logs, ABRT, apport, and coredumpctl output. Forensics should inspect crashing process backtraces for libssh functions involved in channel handling or callbacks. Network telemetry may show repeated short-lived SSH connections or channel open/close sequences preceding process restarts, but there is no unique exploit signature in the provided intelligence. Because the impact is availability-focused, absence of file changes or privilege escalation artifacts does not rule out attempted exploitation.

• libssh.so
• libssh.so.4
• segfault
• SIGSEGV
• core dumped
• coredumpctl
• systemd-coredump
• abrt-hook-ccpp
• apport
• ssh_channel
• channel_close
• channel closed
• callback
• use-after-free
• /var/lib/systemd/coredump/
• /var/spool/abrt/
• /var/crash/

What your security team should do

• Inventory applications, services, containers, appliances, and automation tools that use Red Hat libssh packages or embed libssh.
• Prioritize patching for internet-facing, multi-tenant, or operationally critical services that expose libssh-backed SSH functionality.
• Apply RHSA-2026:42922 and upgrade libssh-main to 0.12.1-4.hum1 or later, then restart dependent services.
• If patching is delayed, restrict SSH access to trusted source networks and remove unnecessary low-privileged SSH access.
• Monitor for crashes, core dumps, segmentation faults, or abnormal restarts in libssh-using services after SSH channel activity.
• Update detection content to alert on repeated service crashes correlated with SSH connections, especially where the same source repeatedly opens and closes channels.
• Track vendor advisories for downstream products that bundle libssh, because embedded or statically linked copies may require separate updates.